Advisories · Technology

Photo Gallery by 10Web – Mobile-Friendly Image Gallery.

Every CVE that names Photo Gallery by 10Web – Mobile-Friendly Image Gallery among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-18557 CVE record

CVSS 6.1 Medium

Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 15 Oct 2026
CVE-2026-92974 CVE record

CVSS 6.1 Medium

Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 3 Oct 2026
CVE-2026-85652 CVE record

CVSS 6.5 Medium

Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- SQL injection
Not analysed yet 18 Sept 2026
CVE-2026-86311 CVE record

CVSS 6.4 Medium

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 17 Sept 2026
CVE-2026-9829 CVE record

CVSS 6.5 Medium

Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- SQL injection
Not analysed yet 6 Jun 2026
CVE-2026-7048 CVE record

CVSS 6.5 Medium

Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- SQL injection
Not analysed yet 28 May 2026
CVE-2026-1036 CVE record

CVSS 5.3 Medium

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Broken access control
Not analysed yet 21 Jan 2026
CVE-2025-2269 CVE record

CVSS 6.1 Medium

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 11 Apr 2025
CVE-2024-9878 CVE record

CVSS 4.4 Medium

Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2024
CVE-2024-5481 CVE record

CVSS 6.8 Medium

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Path traversal
Not analysed yet 7 Jun 2024
CVE-2024-5426 CVE record

CVSS 6.4 Medium

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 7 Jun 2024
CVE-2024-2296 CVE record

CVSS 5.5 Medium

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 6 Apr 2024
CVE-2024-0221 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Path traversal
Not analysed yet 5 Feb 2024
CVE-2023-6924 CVE record

CVSS 4.4 Medium

Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 11 Jan 2024
CVE-2022-1394 CVE record

Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 6 Jun 2022
CVE-2022-1282 CVE record

Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 2 May 2022
CVE-2022-1281 CVE record

Photo Gallery < 1.6.3 - Unauthenticated SQL Injection
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- SQL injection
Not analysed yet 2 May 2022
CVE-2022-0169 CVE record

Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- SQL injection
Not analysed yet 14 Mar 2022
CVE-2021-25041 CVE record

Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 6 Dec 2021
CVE-2021-24363 CVE record

Photo Gallery < 1.5.75 - File Upload Path Traversal
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Path traversal
Not analysed yet 16 Aug 2021
CVE-2021-24362 CVE record

Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 16 Aug 2021
CVE-2021-24310 CVE record

Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
Not analysed yet 1 Jun 2021